Those who should know about the details on this were notified by email.

Create a separate VPS for aur-dev so we can test new AUR role and also new AUR deployments
without breaking main AUR.

Created a new variable called archweb_allowed_hosts that allows ipxe.archlinux.org
to be served under archweb. We make sure on the nginx template that only a small subset
of the locations is served with weaker ciphers.

Restored the alternate domains variable, otherwise the maintenace mode role would not run.

Changed the nginx template to handle includes and also reworked the way the dict is used, by using
the dict2items filter on the template directly. We also have create a custom template for ipxe.archlinux.org
using weaker ciphers.

roles/archweb: Rework the variables so we get rid of the alternate_domains and create a new dict for custom ngnix templates

Removed the alternate domains variable and now we use the dict directly inside the nginx template. Also create a dict containing
the domains and custom templates for each of them. Right now we only have a custom template for ipxe.archlinux.org.

Added makerepropkg to the list of tools allowed on archbuild role.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Eli Schwartz authored 5 years ago and Florian Pritz committed 5 years ago

Whitelist all extensions known to makepkg.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

From dircolors -p

Initial commit for adding ipxe.archlinux.org domain as an alternative domain
for www.archlinux.org, to be able to host the images with weaker cipher suites.

This gives us a maximum history of 1 year, configurable per-room down to
1 day.

synapse 1.7.0 now disables publishing the public room list by default.

irccat allows connections on 12345 on localhost and forwards them to the
archlinux-devops channel. To be used for zabbix to irc notificatons.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Added bold to make sure that the important information is strongly emphasized when viewing
the README.md file in markdown mode.

Added information regarding the need to have all GPG keys present on the local keyring for
being able to re-encrypt the vault and/or fetch the borg keys for local storage. Also added
instructions for running both the reencrypt-vault-key and fetch-borg-keys playbooks.

For relay host users created on orion set the home directory to /
instead of the default /home/{{inventory_hostname_short}} which is not
created which makes shadow.service fail on orion.

It should not be used as a build server anymore:

https://wiki.archlinux.org/index.php/DeveloperWiki:DevopsMeetings/2019-11-28#Actionable_5

Guillaume has resigned as a dev so we are removing his key and user.

Fix the URL for users coming from the ML.

Remove the flyspray role from apollo. There are still leftovers and nginx
is configured to reply with the maintenance mode, in case someone tries to
access flyspray through apollo.

Create a playbook for the new flyspray deployment. It has all the roles
required to run flyspray.

Given flyspray is not maintained at all and that it is a security liability,
we are creating a VPS for it and isolating it from the rest of the resources.

Instead of compiling the binary or relying on the binary pypi variant.